Latest CVE Feed
-
6.4
MEDIUMCVE-2025-7439
Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $anber_item['button_link']['url']’ parameter in all versions up to, and including, 1.0.1 to insufficient input sanitization and output escaping. This makes it ... Read more
Affected Products :- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Cross-Site Scripting
-
8.8
HIGHCVE-2025-49895
Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5.... Read more
Affected Products :- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Cross-Site Request Forgery
-
4.8
MEDIUMCVE-2025-43490
A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which might allow escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability.... Read more
Affected Products :- Published: Aug. 15, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Authorization
-
8.5
HIGHCVE-2025-8098
An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.... Read more
Affected Products : pc_manager- Published: Aug. 18, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Authorization
-
5.8
MEDIUMCVE-2025-55213
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to impr... Read more
Affected Products : openfga- Published: Aug. 18, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Authorization
-
2.3
LOWCVE-2025-43733
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is... Read more
- Published: Aug. 18, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Cross-Site Scripting
-
5.3
MEDIUMCVE-2025-9108
Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the attack remotely.... Read more
Affected Products : i-diario- Published: Aug. 18, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Misconfiguration
-
6.4
MEDIUMCVE-2025-8143
The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenti... Read more
Affected Products : soledad- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Cross-Site Scripting
-
0.0
NACVE-2025-38549
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths When processing mount options, efivarfs allocates efivarfs_fs_info (sfi) early in fs_context initialization. Howe... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2023-4130
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_in... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-38543
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'.... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-38523
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the smbdirect client code involves using copy_to_iter() to copy data from the smbd_reponse struct's p... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2025-38522
In the Linux kernel, the following vulnerability has been resolved: sched/ext: Prevent update_locked_rq() calls with NULL rq Avoid invoking update_locked_rq() when the runqueue (rq) pointer is NULL in the SCX_CALL_OP and SCX_CALL_OP_RET macros. Previou... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-38515
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Increment job count before swapping tail spsc queue A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while th... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-38512
In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, ... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2025-38508
In the Linux kernel, the following vulnerability has been resolved: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation When using Secure TSC, the GUEST_TSC_FREQ MSR reports a frequency based on the nominal P0 frequency, which deviates slightly... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2025-38507
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. This was reported as an issue on android devic... Read more
Affected Products : linux_kernel- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Denial of Service
-
6.4
MEDIUMCVE-2025-8719
The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘base_lang’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it pos... Read more
Affected Products :- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Cross-Site Scripting
-
5.3
MEDIUMCVE-2025-7499
The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th... Read more
Affected Products :- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Authorization
-
5.4
MEDIUMCVE-2025-8089
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient input sanitization and output escaping. This makes it possible for authentic... Read more
Affected Products : advanced_iframe- Published: Aug. 16, 2025
- Modified: Aug. 18, 2025
- Vuln Type: Cross-Site Scripting